Fix logic. De Morgan's law says: not (A or B) = not A and not B

[flinkflonk]

As mentioned in my comment to video #32 of 38, Basic User Permissions, the logic for throwing the 404 pages is flawed. As is, users with only one attribute (just superuser, or just staff) will get the 404.

Negating the or-clauses means you have to either put them in parentheses, or replace the "or" with an "and" as per De Morgan's laws.

After this patch has been applied staff users don't have to be superusers anymore for the logic to work, which (I assume) was the intention all along.